
This is the first work on mitigating the NN architecture stealing attack with pure-software obfuscations. We propose a total of 8 obfuscating knobs across the entire DNN execution stack to achieve sequence & dimension obfuscations and demonstrate the performance on state-of-the-art GPUs.

We present an obfuscation tool backed by genetic algorithm to search for the best combination of obfuscations to obfuscate any neural network architecture with user-defined inference latency budget. Source code is availableSource Code: https://github.com/zlijingtao/Neurobfuscator.

For sequence obfuscation, our obfuscation tool can obfuscate a ResNet-18 architecture to have a 2.44 LER (which translates to a 44-layer editing distance [1]}) against state-of-art LSTM-based sequence predictors with only 2% increase in overall latency.

For dimension obfuscation, we show how a convolution layer with 64 input and 128 output channels can be obfuscated so that it is extracted as a layer with 207 input and 93 output channels with only 2% increase in layer-level latency.

